Preview regression since mcp 0.38 / fleet edge: new previews of OAuth apps get no app-auth secret — pods wedge Pending #121

New issue

Closed

opened 2026-08-13 17:06:53 +00:00 by ci-bot · 0 comments

ci-bot commented

2026-08-13 17:06:53 +00:00

Collaborator

Observed live on open-platform/www PR #42 (2026-08-13, the first fresh www preview since the edge ship):

The pr-42 overlay in plat/gitops carries plat-edge-token-secret.yaml (new) but no app-auth-secret.yaml — while the pre-edge previews pr-8 and pr-18 of the same app both have it, and prod does too.
Result: preview pods sit Pending forever on Error: secret "app-auth" not found (deployment 0/2, HelmRelease Progressing until timeout).
mcp logged five ci.preview.create events for pr-42 (16:28, 16:29, 16:45, 16:48, 16:59Z) — CI keeps re-invoking, none writes the OAuth secret, and there are no oauth-registration or error lines around them.

Blast radius: every new PR preview of an app that carries auth (the template defaults auth: app since 0.4) — the preview provisioning path in mcp 0.38.x apparently dropped or silently skips the OAuth-app registration + app-auth-secret.yaml render the pre-edge flow did. Existing previews and prod overlays are untouched.

Evidence gathered via operator custody (source-controller artifact listing + kubectl get events on open-platform--www--pr-42 + mcp deploy logs). Exact command lines available on request.

Filed from the import-pane workstream (www #42), which tripped over it; that work reroutes to prod for validation and is not blocked.

Observed live on `open-platform/www` PR #42 (2026-08-13, the first fresh www preview since the edge ship): - The pr-42 overlay in plat/gitops carries `plat-edge-token-secret.yaml` (new) but **no `app-auth-secret.yaml`** — while the pre-edge previews `pr-8` and `pr-18` of the same app both have it, and prod does too. - Result: preview pods sit `Pending` forever on `Error: secret "app-auth" not found` (deployment 0/2, HelmRelease Progressing until timeout). - mcp logged **five** `ci.preview.create` events for pr-42 (16:28, 16:29, 16:45, 16:48, 16:59Z) — CI keeps re-invoking, none writes the OAuth secret, and there are no oauth-registration or error lines around them. Blast radius: every **new** PR preview of an app that carries auth (the template defaults `auth: app` since 0.4) — the preview provisioning path in mcp 0.38.x apparently dropped or silently skips the OAuth-app registration + `app-auth-secret.yaml` render the pre-edge flow did. Existing previews and prod overlays are untouched. Evidence gathered via operator custody (source-controller artifact listing + `kubectl get events` on `open-platform--www--pr-42` + mcp deploy logs). Exact command lines available on request. Filed from the import-pane workstream (www #42), which tripped over it; that work reroutes to prod for validation and is not blocked.